CVE-2026-57516: Ray WebDataset Unsafe Deserialization RCE

CVE-2026-57516 Overview

CVE-2026-57516 is an unsafe deserialization vulnerability in Ray, the distributed compute framework for AI and Python workloads. Versions prior to 2.56.0 contain a flaw in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl or .pickle extensions and invokes torch.load() with weights_only=False on .pt or .pth entries. Arbitrary code executes inside Ray remote workers on every worker that processes the archive. The issue is classified under CWE-502 Deserialization of Untrusted Data.

Critical Impact
A single malicious tar archive processed through read_webdataset() executes attacker-controlled code across every Ray worker touching the dataset, enabling cluster-wide compromise.

Affected Products

Ray distributed compute framework versions prior to 2.56.0
Ray Data WebDataset reader (webdataset_datasource.py)
Any Ray cluster consuming untrusted .tar datasets through read_webdataset()

Discovery Timeline

2026-07-01 - CVE-2026-57516 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-57516

Vulnerability Analysis

Ray Data provides read_webdataset() to ingest datasets packaged in the WebDataset tar-shard format, a common layout for large-scale machine learning training pipelines. The reader iterates entries inside each tar shard and dispatches decoding based on file extension. Entries with .pkl or .pickle extensions are passed directly to Python's pickle.loads(). Entries with .pt or .pth extensions are passed to torch.load() with the weights_only=False flag. Both routines execute arbitrary constructors defined in the serialized payload during object reconstruction. Because Ray Data distributes work across remote worker actors, every worker that touches a shard executes the embedded payload, amplifying the blast radius from a single archive to the entire cluster.

Root Cause

The root cause is trust placed in file-extension routing without validating archive provenance or restricting deserialization to safe primitives. The _default_decoder() implementation treats tar shard contents as trusted Python objects. pickle.loads() and torch.load(..., weights_only=False) are both documented sinks for arbitrary code execution when fed attacker-controlled bytes.

Attack Vector

An attacker crafts a tar archive containing a .pkl, .pickle, .pt, or .pth file whose serialized object defines a __reduce__ method returning an operating-system command. The attacker hosts the archive on an object store, HTTP endpoint, or shared filesystem referenced by the target Ray job. When the pipeline calls read_webdataset() on the malicious URI, each Ray worker decoding a shard invokes the deserializer and executes the payload under the Ray worker process identity. Exploitation requires user interaction in the form of a legitimate operator running a Ray job that references the attacker-supplied dataset URI.

No verified public proof-of-concept code is referenced in the advisory. Technical details are available in the GitHub Security Advisory GHSA-hhrp-gw25-jr43 and the VulnCheck advisory.

Detection Methods for CVE-2026-57516

Indicators of Compromise

Ray worker processes spawning unexpected child processes such as sh, bash, python, curl, or wget immediately after read_webdataset() calls.
Outbound network connections from Ray worker nodes to previously unseen hosts shortly after a data ingestion job starts.
Tar archives containing .pkl, .pickle, .pt, or .pth members sourced from external or unauthenticated locations.
Ray Data job logs referencing _default_decoder alongside deserialization errors or unexpected imports.

Detection Strategies

Inventory Ray deployments and flag any version below 2.56.0 running Ray Data pipelines.
Instrument Ray worker processes to log command-line arguments and parent-child process trees during dataset ingestion.
Scan tar shards referenced by Ray jobs for pickle magic bytes (\\x80\\x04) and PyTorch save headers in entries whose filenames match the WebDataset routing extensions.
Correlate Ray job submissions with the dataset URIs they resolve to and alert on URIs outside an approved allowlist.

Monitoring Recommendations

Monitor Ray head and worker node telemetry for process, network, and file-write anomalies during data loading stages.
Track SBOM entries for the ray Python package across build pipelines and container registries and alert on versions below 2.56.0.
Log and review all Ray Data source URIs and require peer approval for new external dataset locations.

How to Mitigate CVE-2026-57516

Immediate Actions Required

Upgrade Ray to version 2.56.0 or later on all clusters, head nodes, workers, and container images.
Audit existing Ray Data jobs for use of read_webdataset() and validate every referenced tar dataset originates from a trusted, integrity-verified source.
Restrict network egress and dataset URIs available to Ray worker nodes to an explicit allowlist.
Rotate credentials and inspect worker hosts if untrusted WebDataset archives were processed prior to patching.

Patch Information

The Ray project addressed the vulnerability in version 2.56.0. Fixes were delivered in Ray Pull Request #63469 and Ray Pull Request #63470, and the release is documented in the Ray 2.56.0 Release Notes. Coordinated disclosure details are published in GHSA-hhrp-gw25-jr43.

Workarounds

Avoid read_webdataset() on any dataset that is not fully controlled and integrity-signed by your organization.
Strip or reject .pkl, .pickle, .pt, and .pth entries from tar shards before they reach Ray, or repackage datasets into safer formats such as Parquet or Arrow.
Run Ray workers under least-privilege service accounts with restricted filesystem and network access to limit the blast radius of any deserialization payload.
Enforce checksum or signature verification on tar shards prior to ingestion.

bash

# Upgrade Ray to a patched release
pip install --upgrade "ray>=2.56.0"

# Verify the installed version
python -c "import ray; print(ray.__version__)"